{ "type": "bundle", "id": "bundle--596f75c0-9118-4b4c-958b-1921950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--596f75c0-9118-4b4c-958b-1921950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "name": "OSINT - Recent Winnti Infrastructure and Samples", "published": "2017-07-19T15:12:42Z", "object_refs": [ "x-misp-attribute--596f75fd-3e14-4f9c-9b22-4f12950d210f", "observed-data--596f7608-a51c-4471-a7cb-1921950d210f", "url--596f7608-a51c-4471-a7cb-1921950d210f", "indicator--596f7628-5e38-4179-b38d-463a950d210f", "indicator--596f7628-b8d4-4a5f-acd2-49a5950d210f", "indicator--596f7628-7f48-4b52-bb47-41ee950d210f", "indicator--596f7628-c40c-4fa3-ba53-417d950d210f", "indicator--596f7628-92d8-4d90-a228-45d9950d210f", "indicator--596f7628-f05c-4dd0-81c8-4027950d210f", "indicator--596f7628-108c-4bae-becc-4d38950d210f", "indicator--596f7628-1e60-4a7e-ae6f-4760950d210f", "indicator--596f7628-8030-4219-bd9f-419c950d210f", "indicator--596f7628-24cc-4a79-92c8-440d950d210f", "indicator--596f7628-bd8c-4e40-8c39-4184950d210f", "indicator--596f7628-6e60-4fb8-b145-4321950d210f", "indicator--596f7628-7fb0-4462-b7cf-4530950d210f", "indicator--596f7628-4258-4a32-b4de-4c83950d210f", "indicator--596f7628-35f8-44f9-b173-4c59950d210f", "indicator--596f7628-baa8-4903-bb46-4c4f950d210f", "indicator--596f7628-8544-4b5b-811b-4d83950d210f", "indicator--596f7628-890c-430f-8d55-42a0950d210f", "indicator--596f7628-91e8-4f75-90ce-4843950d210f", "indicator--596f7628-7a58-447d-85a5-4448950d210f", "indicator--596f7628-24ac-48ff-87ec-4577950d210f", "indicator--596f7628-0c14-4477-885a-4d1d950d210f", "indicator--596f7628-ae98-4e9c-be52-4804950d210f", "indicator--596f7628-709c-4400-af3d-4b21950d210f", "indicator--596f7628-4520-40e3-9e85-41c6950d210f", "indicator--596f7628-1af4-435b-ad98-4f37950d210f", "indicator--596f7628-acd0-4d76-8ecb-4c27950d210f", "indicator--596f7628-3a3c-4cfd-bdc3-4e75950d210f", "indicator--596f7628-77f8-454e-a5c0-4b68950d210f", "observed-data--596f763e-d9b8-440f-ba05-4ae7950d210f", "file--596f763e-d9b8-440f-ba05-4ae7950d210f", "observed-data--596f763e-4da4-44fd-b644-449a950d210f", "file--596f763e-4da4-44fd-b644-449a950d210f", "observed-data--596f763e-554c-4b80-ad04-4572950d210f", "file--596f763e-554c-4b80-ad04-4572950d210f", "observed-data--596f763e-cff8-44b0-b491-43c7950d210f", "file--596f763e-cff8-44b0-b491-43c7950d210f", "observed-data--596f763e-f29c-4421-81d1-4cc3950d210f", "file--596f763e-f29c-4421-81d1-4cc3950d210f", "observed-data--596f763e-8a94-4675-8f54-4ee2950d210f", "file--596f763e-8a94-4675-8f54-4ee2950d210f", "observed-data--596f763e-fab4-4bc1-a5a6-4901950d210f", "file--596f763e-fab4-4bc1-a5a6-4901950d210f", "observed-data--596f763e-8adc-473a-903d-4aaf950d210f", "file--596f763e-8adc-473a-903d-4aaf950d210f", "observed-data--596f763e-af34-4d5f-bff2-4ff1950d210f", "file--596f763e-af34-4d5f-bff2-4ff1950d210f", "observed-data--596f763e-4e74-408a-8298-446f950d210f", "file--596f763e-4e74-408a-8298-446f950d210f", "observed-data--596f763e-0868-42fc-a1ba-4c9c950d210f", "file--596f763e-0868-42fc-a1ba-4c9c950d210f", "observed-data--596f763e-b320-4b8f-a99f-4f04950d210f", "file--596f763e-b320-4b8f-a99f-4f04950d210f", "observed-data--596f763e-3e98-4782-8f8a-462e950d210f", "file--596f763e-3e98-4782-8f8a-462e950d210f", "observed-data--596f763e-8e68-4af1-b6fc-49ff950d210f", "file--596f763e-8e68-4af1-b6fc-49ff950d210f", "observed-data--596f763e-9f78-4939-ac5d-4f93950d210f", "file--596f763e-9f78-4939-ac5d-4f93950d210f", "observed-data--596f763e-3854-402a-b7cd-4f9f950d210f", "file--596f763e-3854-402a-b7cd-4f9f950d210f", "indicator--596f7651-3758-4e1a-b72f-15a4950d210f", "indicator--596f7651-8224-492c-9b12-15a4950d210f", "indicator--596f7651-85c8-4ac5-a5a0-15a4950d210f", "indicator--596f7651-7244-45b8-ae61-15a4950d210f", "indicator--596f7651-19dc-4af7-bfe1-15a4950d210f", "indicator--596f7651-7098-4c31-9b45-15a4950d210f", "indicator--596f765b-cc6c-4409-96e0-15a4950d210f", "indicator--596f765b-1e9c-4018-aa04-15a4950d210f", "indicator--596f765b-f4f0-4766-875b-15a4950d210f", "indicator--596f765b-d0e0-4dfe-abdb-15a4950d210f", "indicator--596f765b-0518-420c-99ba-15a4950d210f", "indicator--596f765b-15c4-4914-bcd1-15a4950d210f", "indicator--596f765b-b334-4d4d-9991-15a4950d210f", "indicator--596f765b-13b4-4ddd-abc8-15a4950d210f", "indicator--596f765b-8050-4069-8070-15a4950d210f", "indicator--596f765b-7ab8-43ee-a96e-15a4950d210f", "indicator--596f7674-ceb4-4a2a-9cdb-4309950d210f", "indicator--596f768c-8644-4678-9cac-4702950d210f", "indicator--596f76b0-64f8-4079-8b95-19ef950d210f", "indicator--596f76c4-cc14-4cc2-a849-442402de0b81", "indicator--596f76c4-eff0-416f-8c82-4b0f02de0b81", "observed-data--596f76c4-8b78-4bbf-8807-49d202de0b81", "url--596f76c4-8b78-4bbf-8807-49d202de0b81", "indicator--596f76c4-ddd0-4ed9-8610-472f02de0b81", "indicator--596f76c4-7164-4eae-9ee1-486802de0b81", "observed-data--596f76c4-0bc0-4aac-89f4-4dae02de0b81", "url--596f76c4-0bc0-4aac-89f4-4dae02de0b81" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "misp-galaxy:tool=\"Winnti\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--596f75fd-3e14-4f9c-9b22-4f12950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_type": "text", "x_misp_value": "On July 17, 2017, we detected a malicious document in VirusTotal exploiting CVE-2017-0199. By pivoting off of the infrastructure we learned that it is related to Winnti, a Chinese threat actor that is mostly targeting the gaming industry. Below we outline initial findings.\r\n\r\nThe malicious file, named curriculum vitae.rtf (58c66b3ddbc0df9810119bb688ea8fb0) was uploaded from Turkey." }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f7608-a51c-4471-a7cb-1921950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "url--596f7608-a51c-4471-a7cb-1921950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--596f7608-a51c-4471-a7cb-1921950d210f", "value": "http://www.clearskysec.com/winnti/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-5e38-4179-b38d-463a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'mess.googlerenewals.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-b8d4-4a5f-acd2-49a5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'us.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-7f48-4b52-bb47-41ee950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'signup.facebooknavigation.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-c40c-4fa3-ba53-417d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'bot.new.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-92d8-4d90-a228-45d9950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'jp.googlerenewals.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-f05c-4dd0-81c8-4027950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'xn--360tmp-k02m.new.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-108c-4bae-becc-4d38950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'cdn.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-1e60-4a7e-ae6f-4760950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'xn--360tmp-k02m.tmp.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-8030-4219-bd9f-419c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'xn--360tmp-k02m.www.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-24cc-4a79-92c8-440d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'ftp.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-bd8c-4e40-8c39-4184950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'game.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-6e60-4fb8-b145-4321950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'www.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-7fb0-4462-b7cf-4530950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'new.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-4258-4a32-b4de-4c83950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'bot.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-35f8-44f9-b173-4c59950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'vnew.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-baa8-4903-bb46-4c4f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'tmp.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-8544-4b5b-811b-4d83950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'xn--360tmp-k02m.googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-890c-430f-8d55-42a0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'hk.uk.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-91e8-4f75-90ce-4843950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'us.uk.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-7a58-447d-85a5-4448950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'www.uk.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-24ac-48ff-87ec-4577950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'lead1.uk.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-0c14-4477-885a-4d1d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'cdn.uk.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-ae98-4e9c-be52-4804950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'show.uk.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-709c-4400-af3d-4b21950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'uk.uk.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-4520-40e3-9e85-41c6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'news.googlesoftservice.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-1af4-435b-ad98-4f37950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'news.facebooknavigation.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-acd0-4d76-8ecb-4c27950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'backup.aolonline.cc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-3a3c-4cfd-bdc3-4e75950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'uk.igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7628-77f8-454e-a5c0-4b68950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'news.aolonline.cc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-d9b8-440f-ba05-4ae7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-d9b8-440f-ba05-4ae7950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-d9b8-440f-ba05-4ae7950d210f", "name": "NSLS.dll" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-4da4-44fd-b644-449a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-4da4-44fd-b644-449a950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-4da4-44fd-b644-449a950d210f", "name": "HelpPane.exe" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-554c-4b80-ad04-4572950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-554c-4b80-ad04-4572950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-554c-4b80-ad04-4572950d210f", "name": "conf.exe" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-cff8-44b0-b491-43c7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-cff8-44b0-b491-43c7950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-cff8-44b0-b491-43c7950d210f", "name": "msimain17.sdb" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-f29c-4421-81d1-4cc3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-f29c-4421-81d1-4cc3950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-f29c-4421-81d1-4cc3950d210f", "name": "shell.exe" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-8a94-4675-8f54-4ee2950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-8a94-4675-8f54-4ee2950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-8a94-4675-8f54-4ee2950d210f", "name": "715578187~.exe" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-fab4-4bc1-a5a6-4901950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-fab4-4bc1-a5a6-4901950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-fab4-4bc1-a5a6-4901950d210f", "name": "COMSysAppLauncher.exe" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-8adc-473a-903d-4aaf950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-8adc-473a-903d-4aaf950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-8adc-473a-903d-4aaf950d210f", "name": "SysAppLauncher.dll" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-af34-4d5f-bff2-4ff1950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-af34-4d5f-bff2-4ff1950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-af34-4d5f-bff2-4ff1950d210f", "name": "curriculumvitae.rtf" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-4e74-408a-8298-446f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-4e74-408a-8298-446f950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-4e74-408a-8298-446f950d210f", "name": "cryptbase.exe" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-0868-42fc-a1ba-4c9c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-0868-42fc-a1ba-4c9c950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-0868-42fc-a1ba-4c9c950d210f", "name": "sign.exe" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-b320-4b8f-a99f-4f04950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-b320-4b8f-a99f-4f04950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-b320-4b8f-a99f-4f04950d210f", "name": "mess.exe" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-3e98-4782-8f8a-462e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-3e98-4782-8f8a-462e950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-3e98-4782-8f8a-462e950d210f", "name": "cryptbasesvc.dll" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-8e68-4af1-b6fc-49ff950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-8e68-4af1-b6fc-49ff950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-8e68-4af1-b6fc-49ff950d210f", "name": "video(20170201)_2.exe" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-9f78-4939-ac5d-4f93950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-9f78-4939-ac5d-4f93950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-9f78-4939-ac5d-4f93950d210f", "name": "cryptbase.dll" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f763e-3854-402a-b7cd-4f9f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "first_observed": "2017-07-19T15:12:03Z", "last_observed": "2017-07-19T15:12:03Z", "number_observed": 1, "object_refs": [ "file--596f763e-3854-402a-b7cd-4f9f950d210f" ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"" ] }, { "type": "file", "spec_version": "2.1", "id": "file--596f763e-3854-402a-b7cd-4f9f950d210f", "name": "COMSystemApplicationLauncher.dll" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7651-3758-4e1a-b72f-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[email-message:from_ref.value = 'yytxconnecticut@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7651-8224-492c-9b12-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[email-message:from_ref.value = 'sunware1@aol.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7651-85c8-4ac5-a5a0-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[email-message:from_ref.value = 'lileminnesota@hotmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7651-7244-45b8-ae61-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[email-message:from_ref.value = 'dsfsaf@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7651-19dc-4af7-bfe1-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[email-message:from_ref.value = '13836469977@139.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7651-7098-4c31-9b45-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[email-message:from_ref.value = 'fuckccddeefff@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-cc6c-4409-96e0-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'googlesoftservice.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-1e9c-4018-aa04-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'igooglefiles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-f4f0-4766-875b-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'aolonline.cc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-d0e0-4dfe-abdb-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'facebooknavigation.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-0518-420c-99ba-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'googlecustomservice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-15c4-4914-bcd1-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'find2find.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-b334-4d4d-9991-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'tiwwter.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-13b4-4ddd-abc8-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'luckhairs.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-8050-4069-8070-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'googlerenewals.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f765b-7ab8-43ee-a96e-15a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "pattern": "[domain-name:value = 'pornsee.tv']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f7674-ceb4-4a2a-9cdb-4309950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "description": "curriculum vitae.rtf", "pattern": "[file:hashes.MD5 = '58c66b3ddbc0df9810119bb688ea8fb0']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f768c-8644-4678-9cac-4702950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "description": "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995)", "pattern": "[file:hashes.MD5 = 'a4b2a6883ba0451429df29506a1f6995']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f76b0-64f8-4079-8b95-19ef950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:03.000Z", "modified": "2017-07-19T15:12:03.000Z", "description": "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) from", "pattern": "[url:value = 'http://54.245.195.101/shell.exe']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f76c4-cc14-4cc2-a849-442402de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:04.000Z", "modified": "2017-07-19T15:12:04.000Z", "description": "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) - Xchecked via VT: a4b2a6883ba0451429df29506a1f6995", "pattern": "[file:hashes.SHA256 = 'eee4b1c4621b0ca355dc677652dfd6449f1f230565da8cb5db59fa195e8f553f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f76c4-eff0-416f-8c82-4b0f02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:04.000Z", "modified": "2017-07-19T15:12:04.000Z", "description": "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) - Xchecked via VT: a4b2a6883ba0451429df29506a1f6995", "pattern": "[file:hashes.SHA1 = '79daceed3c07eaeac39c69b5c40e03cedcaaaced']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f76c4-8b78-4bbf-8807-49d202de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:04.000Z", "modified": "2017-07-19T15:12:04.000Z", "first_observed": "2017-07-19T15:12:04Z", "last_observed": "2017-07-19T15:12:04Z", "number_observed": 1, "object_refs": [ "url--596f76c4-8b78-4bbf-8807-49d202de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--596f76c4-8b78-4bbf-8807-49d202de0b81", "value": "https://www.virustotal.com/file/eee4b1c4621b0ca355dc677652dfd6449f1f230565da8cb5db59fa195e8f553f/analysis/1500457177/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f76c4-ddd0-4ed9-8610-472f02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:04.000Z", "modified": "2017-07-19T15:12:04.000Z", "description": "curriculum vitae.rtf - Xchecked via VT: 58c66b3ddbc0df9810119bb688ea8fb0", "pattern": "[file:hashes.SHA256 = '1ada845dbf89024f4eee8409880ce21ece2262db3ad5129d2eed33a76d177d39']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--596f76c4-7164-4eae-9ee1-486802de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:04.000Z", "modified": "2017-07-19T15:12:04.000Z", "description": "curriculum vitae.rtf - Xchecked via VT: 58c66b3ddbc0df9810119bb688ea8fb0", "pattern": "[file:hashes.SHA1 = '5486fd254451d90f2f6acdbfa3330444f98dde68']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-07-19T15:12:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--596f76c4-0bc0-4aac-89f4-4dae02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-07-19T15:12:04.000Z", "modified": "2017-07-19T15:12:04.000Z", "first_observed": "2017-07-19T15:12:04Z", "last_observed": "2017-07-19T15:12:04Z", "number_observed": 1, "object_refs": [ "url--596f76c4-0bc0-4aac-89f4-4dae02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--596f76c4-0bc0-4aac-89f4-4dae02de0b81", "value": "https://www.virustotal.com/file/1ada845dbf89024f4eee8409880ce21ece2262db3ad5129d2eed33a76d177d39/analysis/1500445510/" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }